Genetic testing firm 23andMe has filed for Chapter 11 bankruptcy protection, a move that raises concerns among its users regarding the future of their genetic data. The company, headquartered in San Francisco, has indicated that this filing is intended to facilitate a sale process to maximise the business’s value. This announcement came on Sunday, shortly followed by the immediate resignation of co-founder and CEO Anne Wojcicki, who had been with the company since its inception nearly two decades ago.

Wojcicki’s resignation is notable, particularly as it follows a recent rejection by a board committee of her proposal to take the company private. Despite stepping down from her CEO role, she intends to pursue bidding on 23andMe as it navigates the sale process during its bankruptcy.

In its statement regarding the bankruptcy, 23andMe assured customers that the way it stores, manages, or protects their data would remain unchanged during this tumultuous period. However, privacy experts express scepticism, suggesting that users should consider deleting their information due to potential risks. “What we’re witnessing with 23andMe is a stark wake-up call for data privacy,” stated Adrianus Warmenhoven, a cybersecurity expert at NordVPN. He highlighted that genetic data is particularly sensitive and valuable, essentially serving as a comprehensive biological profile.

In response to the bankruptcy, California Attorney General Rob Bonta issued a consumer alert, prompting users to take action by requesting the deletion of their data and destruction of any genetic samples held by the company. Bonta noted that consumers in California have the right to request such deletions under state law.

The company’s financial difficulties have been brewing over the past few years, leading to its decline from a valuation as high as $5.8 billion in 2021 to its current predicament. In recent years, 23andMe has faced scrutiny over its security practices, most notably after a data breach in 2023 that compromised the personal data of approximately 7 million customers, exposing sensitive information like names, addresses, and genetic ancestry. Aspects of this breach have raised concerns about hackers taking advantage of the current upheaval during bankruptcy proceedings.

While 23andMe has reiterated its commitment to data privacy by stating that it does not share genetic information with health insurers, employers, or public databases without user consent, experts underscore that regulations are limited. Notably, the lack of a federal privacy law in the United States complicates the protections surrounding genetic data, with only a fraction of states having enacted their own. David Choffnes, a computer science professor and executive director of Northeastern University’s Cybersecurity and Privacy Institute, remarked on the unique risks associated with genetic information, noting that, unlike compromised email addresses, individuals cannot change their genetic code.

As the company moves forward with its bankruptcy proceedings, it plans to continue its operations while seeking a buyer for its assets. 23andMe is also looking to reduce its overhead by renegotiating office leases in California to cut costs.

For users who wish to delete their data from 23andMe, the process can be completed through the account settings by navigating to the “Delete Data” section. This allows individuals to not only request the deletion of their genetic data but also to withdraw consent for any third-party research involving their samples.

While the fate of 23andMe hangs in the balance, customers wait to see how the once-promising company will handle their data as it seeks new ownership in a challenging market.

Source: Noah Wire Services